Drupal 7 Module Development

* - "delete"
* - "create"
* @param $node
* The node object on which the operation is to be performed, or
* node type (e.g. 'forum') for "create" operation.
* @param $account
* Optional, a user object representing the user for whom the
* operation is to be performed.
* Determines access for a user other than the current user.
* @return
* TRUE if the operation may be performed, FALSE otherwise.
*/
function node_access($op, $node, $account = NULL) {
global $user;
$rights = &drupal_static(__FUNCTION__, array());
From reading over the code, we can use our knowledge of Drupal to infer some
key points:
Chapter 9
• The $op parameter indicates the node operation being requested.
• Creating nodes is a special case, even changing the $node parameter sent to
the function.
• Node Access is a user-driven action. That means it matters who is trying to
perform the operation.
• Node Access in Drupal 7 is statically cached per user for the duration of the
page request. That means that once set, it cannot be changed until another
request is sent or drupal_static_reset('node_access') is called.
Recall our discussion of $user and $account in the previous chapter.
The node_access() function accepts an $account object, but falls back
to using the global $user object if one is not supplied. This feature allows
for access checks to be performed for users other than the current user.
A single node may return different answers to an access request depending on who is
making the request and what request is being made.
[ 245 ]